Microsoft reported detecting about 7.3 billion email-based phishing threats from July through September 2026. Nearly 3 billion were detected in September, 41% more than in August, according to Microsoft’s Q3 threat report, published November 5. The figures describe Microsoft’s telemetry, not a count of people who opened messages or accounts that were compromised.
A rising total can hide opposite trends in individual attack methods. Read each category on its own, and treat detections as activity signals rather than victim counts.
QR-code phishing fell as CAPTCHA-gated attacks rebounded
The overall September increase did not apply to every technique. Microsoft counted about 12.1 million QR-code phishing attacks in Q3, 67% fewer than in Q2. By September, that activity was 86% below its March peak.
CAPTCHA-gated phishing moved the other way from July’s low, reaching 3.1 million attacks in September, nearly twice the July level. SVG files accounted for 65% of this activity in August and 49% in September. Those figures describe the file types in this attack category, not the share of all phishing messages.
Two campaigns used different routes to deceive recipients
Microsoft Defender Research observed a salary-review campaign from August 19 to 20. It targeted more than 10,000 users across more than 4,800 organizations, primarily in the United States. Professional services, especially legal organizations, made up 72.1% of intended targets.
The lure arrived as a personalized salary-review message with a Word attachment containing a QR code. Scanning it led to a fake OneDrive sign-in page, which supplied a device code and directed the recipient to Microsoft’s legitimate device-login portal. If someone completed that sign-in, the technique could transfer a valid session token to the attacker without revealing the person’s password or prompting another multifactor-authentication step. Microsoft described the mechanism as a risk, not a confirmed account takeover.
A separate campaign on September 21 targeted more than 56,000 users across more than 8,100 organizations. Purchase-order lures made up 63% of its messages; payroll lures accounted for 37%. The United States represented 12% of intended recipients in this campaign, a campaign-specific share rather than a measure of phishing across the country.
Microsoft said the campaign’s sender domain passed SPF, DKIM and DMARC checks, while its display name imitated a sales or human-resources identity at the recipient’s organization. The purchase-order messages used a disguised archive containing a JavaScript downloader that fetched a PowerShell payload; Microsoft said that chain led to Agent Tesla. The payroll branch used a different disguised archive containing an executable that Microsoft also identified as Agent Tesla. These were the reported delivery paths, not evidence that recipients ran the files.
Detections and call attempts are not confirmed compromises
Microsoft reported about 129 million malicious messages spoofing business-service sender domains tracked in its analysis. In September, security overrides applied to 63% of messages with a recorded security outcome. Separately, about 94–96% of the quarter’s payload-based attacks directed recipients to phishing sites or fraudulent sign-in pages, making credential theft the dominant attachment-related risk in Microsoft’s analysis.
The report also counted about 6.2 million business-contact-impersonation attacks and 141,000 malicious Microsoft Teams call attempts. The call total included unanswered and rejected calls. Within Microsoft’s observed sample, ordinary personal-name identities rose from 46% of calls in July to 88% in September, while explicit help-desk identities fell from 17% to 2%.
Microsoft recommends reviewing Exchange and Defender settings, using controls such as Safe Links and Safe Attachments, running phishing simulations, adopting passwordless or multifactor sign-in, controlling external Teams access, and investigating or purging malicious messages.
